{% extends 'base.html' %} {# Two-factor auth can be in three states: mfa_init: The user has not setup any two-factor methods or recovery codes mfa_setup: The user has setup recovery codes but no two-factor methods. Two-factor authentication is still disabled. mfa_enabled: The user has setup at least one two-factor method. Two-factor authentication is enabled. #} {% set mfa_enabled = totp_methods or webauthn_methods %} {% set mfa_init = not recovery_methods and not mfa_enabled %} {% set mfa_setup = recovery_methods and not mfa_enabled %} {% block body %}

Two-factor authentication is currently {{ 'enabled' if mfa_enabled else 'disabled' }}. {% if mfa_init %} You need to generate recovery codes and setup at least one authentication method to enable two-factor authentication. {% elif mfa_setup %} You need to setup at least one authentication method to enable two-factor authentication. {% endif %}

{% if mfa_setup or mfa_enabled %}
{% if mfa_enabled %}
{% else %}
{% endif %}
{% endif %}

Recovery Codes

Recovery codes allow you to login and setup new two-factor methods when you lost your registered second factor.

{% if mfa_init %}{% endif %} You need to setup recovery codes before you can setup up authenticator apps or U2F/FIDO2 devices. {% if mfa_init %}{% endif %} Each code can only be used once.

{% if mfa_init %} {% else %} {% endif %}
{% if recovery_methods %}

{{ recovery_methods|length }} recovery codes remain

{% elif not recovery_methods and mfa_enabled %}

You have no remaining recovery codes.

{% endif %}

Authenticator Apps

Use an authenticator application on your mobile device as a second factor.

The authenticator app generates a 6-digit one-time code each time you login. Compatible apps are freely available for most phones.

{% for method in totp_methods %} {% endfor %} {% if not totp_methods %} {% endif %}
Name Registered On
{{ method.name }} {{ method.created.strftime('%b %d, %Y') }} Delete
No authenticator apps registered yet

U2F and FIDO2 Devices

Use an U2F or FIDO2 compatible hardware security key as a second factor.

U2F and FIDO2 devices are not supported by all browsers and can be particularly difficult to use on mobile devices. It is strongly recommended to also setup an authenticator app to be able to login on all browsers.

{% for method in webauthn_methods %} {% endfor %} {% if not webauthn_methods %} {% endif %}
Name Registered On
{{ method.name }} {{ method.created.strftime('%b %d, %Y') }} Delete
No devices registered yet
{% endblock %}